ad70e6c408545413509417c044dd736f0c4d99331d069e6481b3b07aa1127f98

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pattern-theory-site/signup.html
Size 2KB
Sample261014-g211msxt2k
SHA256 ad70e6c408545413509417c044dd736f0c4d99331d069e6481b3b07aa1127f98
MD5 a89b46be1ca48b83960f92ffbfab15d7
SHA1 cb0287f6118b6ae65d52f70efb57209f38c24287
SHA512 2e0a68edb6256ff73cc326770c89ff1a2ecfbfa80a90bece360575d97adf82453a5aab9cb34b27dd58e64b2a4c69c0a8f569c88f74808708c8262cf09dcf7b24
TLSH
T1A051791014D89C48D77225796F88941AEF59C2134388AA10F08CBABB6F759158B2B6BD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4832	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{A8A1E758-640C-4A1F-BD7B-DB068B374A39}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4792	2516	msedge.exe	87
PID 2516 wrote to memory of 4832	2516	msedge.exe	88
PID 2516 wrote to memory of 3852	2516	msedge.exe	89
PID 2516 wrote to memory of 3852	2516	msedge.exe	89
PID 2516 wrote to memory of 3852	2516	msedge.exe	89
PID 2516 wrote to memory of 4764	2516	msedge.exe	90
PID 2516 wrote to memory of 4764	2516	msedge.exe	90
PID 2516 wrote to memory of 1896	2516	msedge.exe	92
PID 2516 wrote to memory of 3496	2516	msedge.exe	93
PID 2516 wrote to memory of 1896	2516	msedge.exe	92
PID 2516 wrote to memory of 1896	2516	msedge.exe	92
PID 2516 wrote to memory of 3496	2516	msedge.exe	93
PID 2516 wrote to memory of 3496	2516	msedge.exe	93
PID 2516 wrote to memory of 204	2516	msedge.exe	94
PID 2516 wrote to memory of 208	2516	msedge.exe	95
PID 2516 wrote to memory of 204	2516	msedge.exe	94
PID 2516 wrote to memory of 204	2516	msedge.exe	94
PID 2516 wrote to memory of 208	2516	msedge.exe	95
PID 2516 wrote to memory of 208	2516	msedge.exe	95
PID 2516 wrote to memory of 4044	2516	msedge.exe	100
PID 2516 wrote to memory of 3636	2516	msedge.exe	101
PID 2516 wrote to memory of 4044	2516	msedge.exe	100
PID 2516 wrote to memory of 3636	2516	msedge.exe	101
PID 2516 wrote to memory of 4484	2516	msedge.exe	103
PID 2516 wrote to memory of 4520	2516	msedge.exe	113
PID 2516 wrote to memory of 2696	2516	msedge.exe	114
PID 2516 wrote to memory of 4156	2516	msedge.exe	115
PID 2516 wrote to memory of 4836	2516	msedge.exe	124
PID 2516 wrote to memory of 4836	2516	msedge.exe	124
PID 2516 wrote to memory of 3908	2516	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pattern-theory-site\signup.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffd68a8c188,0x7ffd68a8c194,0x7ffd68a8c1a0
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,12584228874931035231,3110574252992023423,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7523730428979469690,9464155661855198627,262144 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,4419488311454733645,17236798212748983738,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17393889575506336079,6071261087225546515,2097152 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,4758193462314565230,15116973769844192726,2097152 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,8357103676937635549,12306710305680137524,2097152 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,4469809517784745820,14991276039123379868,2097152 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,8633250434923685473,10124807286247018602,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,13878586756732659641,9140834798291005338,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,17838104693974577156,13015578140135408112,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,17838104693974577156,13015578140135408112,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,8951454826771466703,10566699547794199184,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,4321592760454846676,9103300167463153439,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5622009274190077830,16094931929788269845,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2957158705911966625,3928579598304770026,524288 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,10902204992037514388,15519416725014505367,262144 --field-trial-handle=2304,i,11951113476534905326,12321818057731465449,262144 --variations-seed-version --mojo-platform-channel-handle=972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31d9bb76-4800-4c30-b7bb-657f85780ea4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31d9bb76-4800-4c30-b7bb-657f85780ea4.tmp
Size 8KB
SHA256 dbe59a076470430c5fa2a729860051ec057c51905905d014217b28e1b936adea
MD5 fb67d8977c6dac436519b10920ef7119
SHA1 be1682fe281f230a101112da2ddfece56a945264
SHA512 8ee6a61e69f461c7030cd6e1bb2b41ad6aa67688a1be6fff2ac60144a5bbce86df28aad2df41b6d314a83a78fd8b87010fa40e7762fa84c4fcd9142cbe1fdc66
SSDEEP 96:gqONk0QsjpfuMVwptaL5ih/cIPURHl8h4otop5ViCDgBIPuva6zx8X5FxXxPYvPn:LONg6AmwprQmiUy/E6siX5FCYJi57U6
TLSH
T1AA02F935BD686C7B8DE3AE59B48737239FA5116BE6902F84CAE81B2C01D764C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66537ade-18e9-4043-aa91-d54ff5851995.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\66537ade-18e9-4043-aa91-d54ff5851995.tmp
Size 8KB
SHA256 5a40e4393bc2db34842f722187861591f2d7d6bbda8dc671be335a023822889c
MD5 97a285e6354e0df787487e12353bbff8
SHA1 acf916a30fd42995083ace7d95ce2ef1476a1c16
SHA512 2268188a427fb27853f75d2c52b8a7dbce0ce596d6d52b2cd9fff3fa710c146633201d4feab8435bfc5059797b5d1c38b177fefa9f4ea4a692d0aae1c6dfba7b
SSDEEP 192:GON76AmwpmQmiUyLyEFsiX5FCt5eHxlRwqYU6:GON76ipC8tFsiX5FCteaU6
TLSH
T110124C36E8786C3B4DD3A564F08735139EA45167EB856F84D9EC2B2C02DB58C530BC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68f3818e-2f8c-4a00-bca8-d3e279165ab2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68f3818e-2f8c-4a00-bca8-d3e279165ab2.tmp
Size 21KB
SHA256 2c2eeece617689972aeec77becd510aee391dc80ab67464b2eb83350cbbb8416
MD5 60d6a975ae2f0b9b0c6a85f667587017
SHA1 410b5f6e2f85c20fa27c330d2b828adc6d0a20e9
SHA512 216c98ebb8eaa8bce421abd04e5db518f333b792b4a83f12c37be3251ca977e6c4d416500de2b501131b2b1799047ab4af1ed6a61a09695c7d37d84fefd4dbc3
SSDEEP 384:miFiZcIBzsNa8TUNTUlIlWjgkpu2rQD/39iX5FCt5aPJAxJ8ChM:NFQx7wgOzyNaAaPkJ8Ce
TLSH
T148A28D33DCA49E3BAEA69A55F54A32138FF45177E6C5AF94E6DCAB1C01971CC030AC24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89b63735-0bd8-41ad-b92e-4186bd93706a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89b63735-0bd8-41ad-b92e-4186bd93706a.tmp
Size 18KB
SHA256 a4923366b21522e1b3d3f16ea4eb4af42177a9ccd254f682170346f6fed438cd
MD5 176b68faf8671a2df5d0bc52e5ba6a39
SHA1 295e0680c4d737abbe5aa6ee4f988b0e158c488a
SHA512 8693d761053985ab9743d8ae7445a91c058f2db87fa5cb1972e18067dd2cf71e68ef8654d0ce12bad90246a5e62ec3aac4383df0ccc8f6d746fe4d9c5c339eb7
SSDEEP 384:4ZcIhsNCHjgkpu2rQD/39iX5FCtaaPJAxJ8ChM:GhZzyNaRaPkJ8Ce
TLSH
T159828D72ECB86D3BA9A29525F44736138FF89137E7C51F84D5ED6B2C01D66D8030AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

17ac3ee5-1129-45be-aac6-8f196aa68988.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17ac3ee5-1129-45be-aac6-8f196aa68988.tmp
Size 10KB
SHA256 fcc30e76246be3ae367cc5b036e7e4d1b6572c63c2a85b6590fbe38fda57baa6
MD5 fdb58c33cfede6c3e50d9e52cdff7b3c
SHA1 a55c21eba1245ce2e084574979e4940482d91c5f
SHA512 bc989441a08cdae9e4b96f0cbc449f089fae6d9471e2ecc7a0a6d026d9bf15ba2dfef55a4e2de4c6cfda8f1e8d17781916fff10ac7649f68fb9c2793be68484b
SSDEEP 192:sxZ0RBWf/fVsFGIdpHWHW6+WNGY36KBsIg5dJ:sxZ06f/fVsFn2HbGLZ
TLSH
T145229712AE286A7B8CC7E21DBB55BF53E6F9503261911E48A6FCC61C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ab9b5aa-e84a-43ca-b3aa-ce4851466226.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ab9b5aa-e84a-43ca-b3aa-ce4851466226.tmp
Size 9KB
SHA256 10cdace45eaa7bfc439aaac23ec556b8d4537d193049a87222e79905cbccafbf
MD5 e231f8f4b76b39764b3edd9f70b48a5b
SHA1 b2f67bcb747fa8e57415ff8bc5284f0d5bde3d63
SHA512 52aac6356e4e3ba3a260c0c3c2a3626fbda7b02a86ec3f100501a3fef28fd4e67457ada6fd86ca9531006e9f56d143831ad11c35d93c6857b9ec8133784ab0e8
SSDEEP 192:sxZ0RBWf/fVsKGIdpdWHW6+WNGY3SFBsIg5/J:sxZ06f/fVsKngHbG2n
TLSH
T1C722B812AE28A97B8CC7D21DBB55BF53E6F9503261951E48A6FCC51C04E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6a5c856ed238f11ec11fa78b6fe0ec4160715abc1a597dd331747a22f9a8fc87
MD5 ad1f1afa426a50fabd632588a75f02a8
SHA1 0a40c3d1f266119bbe0fdb0542dd2196445b80e1
SHA512 1d7b3f9e8a72b6de520cd12c52f26eae8593726deddbf236e45dde47f7f29a96ee1ee090ec86a0fbff94f33786fecdf43f037dca923b22889d3f02b85478fd08
TLSH
T1F06170C198A14095FBF744F392E5F08B37F846A38FB32DB19364D978D70E745A21A04A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d1176b3e88109f91d22d7676e59301133fb44785fdbb2c1f05cb518888103699
MD5 3036d6b608755ace5223adb014a3e4e6
SHA1 78662a745270573ae8ee4d450a2a9b246ce3d53b
SHA512 5def9e60e23eb614b3e8f6f03bb7d4cde444926ed73bb9f80302a55a47f067b3d190465cd23adfef4ff9abe601fb86afc6901cb8c374686ce399423c468672e3
TLSH
T1A16181C198A14095FBFB44F392E5F08B37F44AA38FB32DB19358D978D70E745A21A04A
MD5 SHA1 SHA512 TLSH

Submit Download

c1020883-a76d-415d-bc53-50eea873e263.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c1020883-a76d-415d-bc53-50eea873e263.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

05948266-6f74-44ea-9f13-20c13f7e7eec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05948266-6f74-44ea-9f13-20c13f7e7eec.tmp
Size 949B
SHA256 5a98b2e48e766806b66adde2b58d974af5e2c2b90833d5be61ef4ea50f603db8
MD5 484e0aa261f036441bca0e7d1b7b3260
SHA1 63578056fce606323d9e319024798a86a5b6caec
SHA512 9bc179439b9af9cb2a67704a371e84a5d9c0669e895ec9290e57d16e9588e523b78fe8c941b7c7b76d8f2aa144f8dda791a20e42c3537eb8391302bb51d7ebaa
TLSH
T19E117DF3C3D586AECA4157F06A24AE2BCE1D0506421C7C1AC9D4EF2793E30B5E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

9a22e310-5397-421d-87a8-0b4acbde576a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9a22e310-5397-421d-87a8-0b4acbde576a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ffbedef1-e487-49e2-971e-c2561dc8b423.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ffbedef1-e487-49e2-971e-c2561dc8b423.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 adad86f330a777612e80418129d985082d4d76cd16b4e05d66845531f8e3d504
MD5 af7eb8c5ae806820091590b908f18b23
SHA1 d6f162d81f8d5561be38d05df1f40b6898b062c1
SHA512 3a562f40943207e10d0d63c2c7a5b3a00f3cbfc60928bcbb7b02cd462c883ea1517b8ed396ab747f7b0afa133d5e6a7f0a308deb874cee1ae424bbe09c14963b
SSDEEP 192:sxZ0RBWf/fVsFGIdpdWHW6+WNGY3ttBsIg5dJ:sxZ06f/fVsFngHbG7Z
TLSH
T17322A712AE286A7B8CC7E21DBB557F53E6F9503261911E48A6FCC61C05E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3d40d6b-d9b9-4176-8e8d-91f640a20d8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3d40d6b-d9b9-4176-8e8d-91f640a20d8e.tmp
Size 27KB
SHA256 fc14e4492c8ade8f801d289bb825e6392a298c320dae2517cc44363feadf781d
MD5 d399dbaa67c178b47467281f33a402ce
SHA1 366399992f7730ce2f59c1f8d723834cb2902f66
SHA512 00ad719496618fcae807c7786b2fe2064bef37a30a7935144cf5003f3eac5a9852aae61f81f563305d128e8d8a00365887d22bbc44fce09d658223121004a4b7
SSDEEP 768:Ff30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72orolZMN:Ff30AbSWvS2l9u1jaLmLZ12T2
TLSH
T11CC2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA944C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c91ca5e8-c100-4368-8d69-6775f5b908b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c91ca5e8-c100-4368-8d69-6775f5b908b9.tmp
Size 9KB
SHA256 afec82ff5bd0b2d171156697d442739a2a8be6992217f3dd4fd1efc0443404e8
MD5 b64a7099bc21efbaddde3827a606f34f
SHA1 55421def83a0439c54b530eedc52311187544a87
SHA512 78a3779263370349c90a4b71a153014517ec3de2d3ad76c2da173b4c46814f788a426ddb31e239f25e19accda823929874f9e0e0946dd69a350b8d3a30f448a0
SSDEEP 192:sxZ0RBWf/fVsUGIdpdWHW6+WNGY3SFBsIgrJ:sxZ06f/fVsUngHbG29
TLSH
T14422B7126E28A97B8CC7E21DBB55BF53E6F95032A1951E48A6FCC51C04E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9a4efed-62ab-4ca8-9dc4-fd121ce02d70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9a4efed-62ab-4ca8-9dc4-fd121ce02d70.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23b889e4-665d-4dcd-b550-388bcbcfb204.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\23b889e4-665d-4dcd-b550-388bcbcfb204.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

cf564ee7-ab69-41ed-a097-908d8b318bf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf564ee7-ab69-41ed-a097-908d8b318bf5.tmp
Size 18KB
SHA256 9b119ae8e980dc4ef6424c5a7e7a72483577e994c829e284df9330329e7227bd
MD5 8929936425b1ca373e8e754aab54c481
SHA1 a0d72314b60905b3073a4a48aea4d3ba04c7dd37
SHA512 a6376dcac03ee6a32878972e2aaf79d981bab23984ba2c34db58443307fd5cc14a1a6a3c798b1fec0db373860203cbd120fc2bb1faec751aef3f99d48ce1abfa
SSDEEP 384:CZcIhsNCWjgkpu2rQD/39iX5FCtaaPJAxJ8ChM:whazyNaRaPkJ8Ce
TLSH
T11F828D72ECB46D3799A2E525F44636138FF89137E7C91F84D5ED6B2C01D66C8030AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adc79239-0d34-4188-aaeb-350767c2e322.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\adc79239-0d34-4188-aaeb-350767c2e322.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ec9452df617dfe8e8a49131366190735f58d47b0f8458810e4caf50465ac7f70
MD5 fea9c606d23318e98fb8b7236fbf51a6
SHA1 60ffa636fe6e6de18bd5042ecd81b95243ee605c
SHA512 2b3afe81b4b848778b1e1980e6271c9d0bf48d6d792b31f433b6039550ae6bbd464f85d34365c9d9f18a752d64261b9b933db4da28ae3832cc37acef42ae5591
TLSH
T1D0412A58BAEA1148F3B37E16AFF2E86E487B7D671E06D59D00150E4F0A27A40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download